Zero Harbor Security · Atlanta metro, Georgia
OSCP- and CISSP-certified offensive security, paired with production engineering from inside AWS, a top-ten US bank and a Fortune 500 insurer. A decade each — and you meet all of us.
The deal is signed off. Their security review is the last thing standing. They want a current third-party test with a real name on it. That is the test this firm runs.
The findings that stop a deal are rarely a missing patch. They are a permission boundary that holds in the interface and not at the API, or three low-severity issues that chain into one critical. Those need somebody who understands what your system is supposed to do.
5 days end to end
Tooling runs coverage because it is genuinely better at breadth. The billed hours go into exploitation, chaining findings together, and the access-control and business-logic flaws no scanner models. The attestation carries the name of the operator who did the work.
10 business days, from authorisation
Quoted from signed authorisation rather than from first contact, because scoping and your own legal review are not ours to control. Plenty of firms advertise a turnaround. Almost none put one in the engagement letter.
“Simply running an automated tool does not satisfy the penetration testing requirement… The penetration tester must interpret the results of any automated tools and determine whether additional testing is needed.”
The work
Every firm in this market says its testing is thorough. Rather than say it, here is the shape of what gets delivered — the classes that stop enterprise deals, written the way they arrive: a location you can check, an impact stated in business terms, and a rating a reviewer can act on.
Findings summary · illustrative
GET /api/v2/reports/{id}
An authenticated user of one tenant could read another tenant’s reports by changing a single identifier. Exploited end to end and reproduced in the report.
POST /auth/reset
A token captured from a forwarded email stayed valid indefinitely, allowing account takeover long after the legitimate reset.
PATCH /api/v2/members/{id}/role
A standard member could grant themselves administrator rights by calling the endpoint directly.
Set-Cookie: session
Widens the window for cross-site request forgery where another finding provides the entry point.
Illustrative findings, written to show the format. They are not drawn from any client engagement — work delivered for a client belongs to that client.
What you receive
A penetration test report is worth exactly what the person reading it will accept — and that person is rarely you. It gets forwarded to an assessor, or to a security reviewer at your customer, who was not in the room and cannot ask you a question.
Forwarded to your prospect’s security lead
One to two pages, written to be sent on without editing. This is the document that moves the deal.
Read by your engineers
Every finding with evidence, a severity rating, the business impact and a specific remediation step.
Filed by their reviewer
One page naming the operator who ran the test, with credentials, scope, method and dates. Usually the exact thing a security review is asking for.
Answers “what did you not test?”
What was checked and how, test by test — including the checks that found nothing. A clean result should still show the work.
How it runs
Not from your first email. Scoping and your own legal review are not ours to control, so the clock starts where our responsibility does.
Day 0
The clock starts here, not at your first email.
Days 1–4
Tooling runs coverage; the hours go into exploitation and chaining.
Day 5
Findings written up, rated and evidenced.
By day 10
Report, executive summary and attestation letter in your hands.
If the report is late, part of the fee comes back — written into the engagement letter, not just onto this page.
The full scopeWho signs
The common failure in this market is not technical. It is being quoted a senior and delivered a junior, with a report signed by somebody who never touched the system.
Amazon Web Services
Built the end-to-end AWS penetration testing programme — scoping through to executive reporting.
Truist
Infrastructure, application and physical security testing at a top-ten US bank.
Korean System Assurance
Tested intrusion prevention systems and firewalls to NSS Labs, Tolly Group and ICSA Lab standards, for the Korean government.
These are employers, not clients. The operators and the full record →
When not to
Some of these are free alternatives. Naming them costs less than taking an engagement that was never going to help — and if you are weighing whether to put this firm in front of a client of your own, knowing where it is the wrong answer is more useful than another page of claims.
If the review wants policies, a SOC 2 report you already hold, or answers to a standard questionnaire, a trust centre closes it faster and cheaper than this.
Several bundle or broker a test on higher plans. Check what you already own before buying it twice.
Ten business days runs from signed authorisation, and authorisation takes a few days of its own. If your contract signs sooner, this cannot help.
A point-in-time test answers a point-in-time question. If you need always-on scanning, a platform serves you better and we will tell you which.
At that size the fee is usually disproportionate to the deal. Ask your reviewer whether a self-assessment plus a remediation commitment clears the gate.
A scoping call within one business day, then a fixed price and a delivery date in writing. If the work is not a fit, we will say so and point you somewhere better.
